1. Field of the Invention
The present invention relates generally to a vehicle-onboard control system for a motor vehicle, which system is installed on a motor vehicle and which includes a control apparatus such as an electronic control unit (also referred to as the ECU in abbreviation) for controlling devices mounted on the motor vehicle such as a power train composed of an internal combustion engine, a transmission and others. More specifically, the present invention is concerned with a vehicle-onboard control system which includes a backup random access memory (hereinafter also referred to as the backup RAM) for storing control variables and which can initialize automatically the backup RAM without fail when the specifications of a control program which is to run on a central processing unit or CPU incorporated in the control apparatus is altered or exchanged by a new one. Further, the invention is also concerned with a method of rewriting the control program and the control variables therefor.
2. Description of Related Art
For having better understanding of the present invention, description will first be made of the background technique thereof. FIG. 8 is a block diagram showing, by way of example, a general arrangement of a conventional vehicle-onboard control system (e.g. engine control apparatus) known heretofore.
Referring to the figure, the conventional vehicle-control system includes a control apparatus such as, for example, an engine control apparatus or ECU, which apparatus is comprised of a microcomputer 10, a reset control circuit 20 for initializing or resetting the operation state of the microcomputer 10, a backup power supply circuit 30 for backing up a power supply to the microcomputer 10, and an external input/output interface (not shown) for interconnecting an external control-destined object (which will be described later on) 40 to an input/output interface 16 incorporated in the microcomputer 10.
The microcomputer 10 in turn is comprised of a CPU (Central Processing Unit) 11 for controlling onboard apparatuses or devices 40 such as an internal combustion engine, a power train including a transmission and/or the like mounted on a motor vehicle, a writable non-volatile ROM (Read-Only Memory) 12 storing a control program or programs executed by the CPU 11 for controlling operations of the apparatus or device mentioned above, a bootstrap program 13 also executed by the CPU 11 for altering the program stored in the writable non-volatile ROM 12, and a backup RAM (Random Access Memory) 14 for storing control variables employed in the execution of the control program or programs.
The writable non-volatile ROM 12 is constituted by an erasable programmable read-only memory or EPROM in abbreviation such as a flush ROM.
Parenthetically, it should be mentioned that the bootstrap program 13 is stored also in a ROM which is provided separately from the writable non-volatile ROM 12.
Further, the microcomputer 10 is equipped with an address changing circuit 15 interposed between the CPU 11 on one hand and the writable non-volatile ROM 12 and the bootstrap program 13 on the other hand, wherein the address changing circuit 15 serves for changing over or switching the execution address of a memory map (described later on) of the CPU 11 to the bootstrap program 13 from the control program stored in the writable non-volatile ROM 12 upon rewriting of the control program.
Besides, the microcomputer 10 is provided with the input/output interface 16 and a backup-power-supply-off decision circuit 17 for making decision whether or not the power supply from the backup power supply circuit 30 is interrupted or off.
The CPU 11 incorporated in the microcomputer 10 is connected to a control-destined object or devices 40 (described hereinafter) by way of the input/output interface 16 and the external input/output interface (not shown). Ordinarily, the backup-power-supply-off decision circuit 17 holds the on-state information indicating that the backup power supply circuit 30 is validated. However, when the backup power supply circuit 30 is broken (i.e., assumes off-state) even once, the backup-power-supply-off decision circuit 17 is fixed to the state indicating the off-state of the backup power supply circuit 30.
The writable non-volatile ROM 12 storing the control program and the ROM storing the bootstrap program 13 both provided internally of the microcomputer 10 can be selectively connected to the CPU 11 via the address changing circuit 15, whereas the backup RAM 14, the input/output interface 16 and the backup-power-supply-off decision circuit 17 are connected directly to the CPU 11.
Furthermore, the backup RAM 14 and the backup-power-supply-off decision circuit 17 are connected to the backup power supply circuit 30 as well.
The input/output interface 16 provided internally of the microcomputer 10 is connected to an internal combustion engine 40 (hereinafter referred to as the engine in abbreviation) which constitutes one of the control-destined objects or devices via the external input/output interface (not shown) which constitutes a part of the vehicle-onboard control system, while the backup power supply circuit 30 is connected to an onboard battery 41 and other various vehicle-onboard control devices 42 (such as a telephone set, a time piece, a radio receiver and the like).
The backup RAM 14 is supplied with an electric power from the battery 41 by way of the backup power supply circuit 30.
A memory rewriting device 50 is adapted to be connected to the control apparatus 1 by way of a bidirectional communication line L upon rewriting or updating the control program stored in the writable non-volatile ROM 12 and so designed as to generate as output signals to this end a rewrite signal A for rewriting the control program stored in the writable non-volatile ROM 12 in accordance with updated specifications together with a command signal C and various data therefor (not illustrated).
In response to the rewrite signal A having the form of an on/off signal, the reset control circuit 20 and the address changing circuit 15 are put into operation, whereby the operation state (current address) of the CPU 11 is reset by a reset signal R generated by the reset control circuit 20 while the bootstrap program 13 is placed at the execution-destined address for the CPU 11 after having been reset.
The command signal C containing a command and data are inputted to the CPU 11 via the communication line L by way of an input/output interface (not shown) for thereby activating the bootstrap program 13 to execute the initialization processing for initializing or clearing the control program stored in the writable non-volatile ROM 12, the data check/rewrite processing and others.
FIGS. 9A and 9B are diagrams for illustrating inter-location relationship in the memory map as viewed from the CPU 11, wherein FIG. 9A shows an ordinary or normal state (where the rewrite signal A is invalid) and FIG. 9B shows a rewriting state (where rewrite signal A is validated).
Change of the individual memory areas from the ordinary or normal state (FIG. 9A) to the rewriting state (FIG. 9B) is realized by the address changing circuit 15, wherein the start addresses for execution of the control program after the resetting is allocated to a location corresponding to the bottom of the memory map.
More specifically, the rewrite bootstrap program 13 is located outside of the execution-destined address region (refer to phantom-line block 13 shown in FIG. 9A) externally of the memory map of the CPU 11 in the ordinary state (see FIG. 9A). However, when the control program rewrite operation is to be performed, the bootstrap program 13 is changed to the executable address position from which the CPU 11 can start the processing operation (see FIG. 9B).
FIGS. 10 to 12 are flow charts for illustrating processing routines executed by the bootstrap program 13, wherein FIG. 10 shows an initialization processing routine executed by the bootstrap program 13, FIG. 11 shows a serial interrupt processing routine (SCI routine) executed in response to the command signal C, and FIG. 12 is a flow chart for illustrating a write processing procedure executed in accordance with the bootstrap program 13 in response to the command signal C on the basis of the data signal. Furthermore, FIG. 13 is a flow chart for illustrating a processing routine executed in accordance with the updated control program stored in the writable non-volatile ROM 12.
Now referring to FIGS. 9 to 13 in combination with FIG. 8, operation of the conventional vehicle-onboard control system known heretofore will be explained.
The CPU 11 incorporated in the control apparatus 1 ordinarily executes the control program which is located at the executable address area of the memory map (i.e., the program written in the writable non-volatile ROM 12) as shown in FIG. 9A, to thereby perform control of operation of the engine 40. On the other hand, when the control program is to be rewritten in accordance with the updated specifications for the engine control, the CPU 11 executes the bootstrap program 13 which is then located at the executable address area as shown in FIG. 9B.
In general, in the vehicle-onboard control system destined for controlling the onboard devices such as the engine 40 and others of a motor vehicle, the control program stored in the writable non-volatile ROM 12 is rewritten in accordance with the specifications as renewed or updated. In that case, in order to prevent the rewrite processing program from being erased even when the contents of the writable non-volatile ROM 12 is erased, rewriting of the control program is executed by the bootstrap program 13 which is stored in a ROM provided separately or independently from the writable non-volatile ROM 12.
Furthermore, in conjunction with the changing-over of the programs (i.e., the control program and the bootstrap program) to be executed by the CPU 11, it should be mentioned that the address changing circuit 15 incorporated in the microcomputer 10 selects the control program stored in the writable non-volatile ROM 12 (see FIG. 9A) when the rewrite signal A generated by the memory rewriting device 50 is in the off-state (ordinary state) while selecting the bootstrap program 13 (see FIG. 9B) when the rewrite signal A is in the on-state commanding the rewriting of the control program.
More specifically, in response to the change of the rewrite signal A from the off-state to the on-state, the program executed by the CPU 11 is changed from the control program stored in the writable non-volatile ROM 12 to the bootstrap program 13 stored in another ROM, whereas in response to the change of the rewrite signal A from the on-state to the off-state, the program executed by the CPU 11 is changed from the bootstrap program to the control program stored in the writable non-volatile ROM 12. Furthermore, upon every changing of the state of the rewrite signal A, the reset signal R is generated by the reset control circuit 20.
In this way, the control program or the bootstrap program 13 is executed, starting from the execution-destined address after the resetting brought about by the reset signal R.
In this conjunction, it is noted that there may arise such situation in which the control variables such as learned values stored in the backup RAM 14 are not altered or updated even when the control program stored in the writable non-volatile ROM 12 is altered or updated. In that case, the CPU 11 will execute the altered or updated control program by using the control variables remaining intact in the backup RAM 14 (i.e., the control variables used by the preceding control program), which will result in erroneous control of operation of the internal combustion engine 40 and/or other devices mounted on the motor vehicle.
For the reason mentioned above, when the control program stored in the writable non-volatile ROM 12 is altered, it is necessary to initialize the control variables stored in the backup RAM 14 to values conforming with the renewed specifications reflected by the altered control program in order to evade inconveniences or problems ascribable to mismatching between the altered or updated control program and the control variables employed in the preceding control program.
Such being the circumstances, there has heretofore been adopted such a method that upon rewriting of the control program, the power supply to the backup power supply circuit 30 from the battery 41 is temporarily interrupted by disconnecting the battery 41 from the vehicle-onboard control system so that initialization of the backup RAM 14 can be validated on the basis of the information available from the backup-power-supply-off decision circuit 17 upon reactivation of the control program.
Furthermore, there has been also adopted such a method according to which a decision reference value stored in the writable non-volatile ROM 12 is compared with a predetermined certain value stored in the backup RAM 14 to thereby initialize the backup RAM 14 when discrepancy is found between the decision reference value and the predetermined certain value as a result of the comparison.
Now, when the control program stored in the ROM 12 is to be rewritten, the CPU 11 incorporated in the control apparatus 1 responds to the command signal C issued by the memory rewriting device 50 to activate the bootstrap program 13 to thereby execute various initialization processings, as shown in FIG. 10. More specifically, in a step S1 shown in FIG. 10, a serial interrupt processing via the serial communication line L is enabled, and a write flag FW in a given register (not shown) is cleared, whereby the CPU 11 is set to the standby state ready for executing the interrupt processing routine.
Subsequently, the interrupt processing routine shown in FIG. 11 is activated in response to the command signal C, and it is decided in a step S11 whether or not the write flag FW is set. When the write flag FW is set (i.e., when the answer of the decision step S11 is affirmative or "YES"), a write processing for altering the control program is executed in a step S12, whereupon return is made to the interrupt processing routine enabling state.
Parenthetically, in the initial state, the write flag FW is cleared in the step S1 shown in FIG. 10. Consequently, the decision step S11 will result in negation or "NO", which is then followed by a decision step S13 where it is decided whether the command signal C represents a command for initialization (i.e., initialize command) or not.
When decision is made in the step S13 that the command signal C is the initialize command (i.e., when the answer of the step S13 is "YES"), the content of the writable non-volatile ROM 12 is erased in a step S14, whereupon the interrupt processing routine enabling state (i.e., the start state) is resumed. On the contrary, when it is decided that the command signal C is not the initialize command (i.e., when the step S13 results in "NO"), then decision is made whether the command signal C represents a check sum command in a step S15.
When the command signal C is a check sum command, values of all the memory locations of the writable non-volatile ROM 12 are summed up to determine a total sum value which is then sent to the memory rewriting device 50 in a step S16, whereupon return is made to the interrupt processing routine enabling state.
In that case, when the total sum value of the writable non-volatile ROM 12 is abnormal, it is then determined that the rewriting of the control program has not been executed accurately. Thus, the rewrite processing based on the data signal is again commanded by the memory rewriting device 50.
Further, when it is decided in the step S15 that the command signal C does not represent the check sum command (i.e., when the answer of this step is "NO"), then a step S17 is executed to decide whether the command signal C is a write command or not.
When the command signal C is decided as the write command (i.e., when the step S17 results in "YES"), the write flag FW is set and at the same time a counter CNT1 which serves for counting the number of data stored in the writable non-volatile ROM 12 is cleared in a step S18, whereon the interrupt processing routine enabling state is regained.
On the other hand, when decision is made that the command signal C is not the write command (i.e., when the step S17 results in "NO"), this means that the command signal C can not discriminatively be identified. In that case, a signal indicative of an error state is sent to the memory rewriting device 50 (step S19), whereupon the processing returns to the interrupt processing routine enabling state (start state).
The memory rewriting device 50 responds to the error signal to thereby output again the command signal C.
The write processing step S12 shown in FIG. 11 is executed in such a manner as illustrated in FIG. 12.
Referring to FIG. 12, the leading address of the writable non-volatile ROM 12 is added with the address of the counter CNT1, and the received data (i.e., data supplied in terms of the data signal) is written at the address obtained from the above-mentioned addition (step S21), whereon the value of the counter CNT1 is incremented by one (step S22).
However, in the initial state, the counter CNT1 is cleared in the step S18 shown in FIG. 11. Accordingly, incrementation of the counter CNT1 is repeated until a predetermined data number N has been reached (step S22).
In succession, it is determined whether or not data have been written in all the memory areas by checking whether or not the content of the counter CNT1 has reached or exceeded the predetermined number N of data in a step S23. When decision is made that the counter value CNT1 is smaller than N (i.e., when the decision step S23 results in "NO"), the processing immediately proceeds to the exit to leave the write processing routine shown in FIG. 12.
By contrast, when the above decision results in that CNT1.gtoreq.N (i.e., "YES"), the check sum value of the writable non-volatile ROM 12 is sent to the memory rewriting device 50 (step S24), and the write flag FW is cleared (step S25), whereon the processing leaves the write routine shown in FIG. 12.
In this way, by executing the bootstrap program 13, the control program stored in the writable non-volatile ROM 12 is updated so as to conform with the new specifications of the control-destined object.
Subsequently, the memory rewriting device 50 turns off the rewrite signal A from the on-state thereof, whereby the updated control program is activated, as is illustrated in FIG. 13.
In this case, the CPU 11 checks the state of the backup-power-supply-off decision circuit 17 to thereby decide whether the backup power supply circuit 30 is in the off-state or not (step S31).
When decision is made that the backup power supply circuit 30 has not been turned off at all but remains in the backup state (i.e., when the answer of the step S31 is "NO"), the decision reference value stored in the writable non-volatile ROM 12 is compared with the predetermined certain value stored in the backup RAM 14, as mentioned previously. In dependence on whether or not both values mentioned above coincide with each other, it is decided that the data (control variables) held in the backup RAM 14 are normal or alternatively abnormal (step S32).
When the predetermined value held in the backup RAM 14 coincides with the decision reference value stored in the writable non-volatile ROM 12, indicating that the data for the control variables are normal, then initialization processing is performed for the other RAMs than the backup RAM 14 (step S36), which is then followed by execution of ordinary control processing (step S34).
On the other hand, when it is decided that the backup power supply is off or backup data is abnormal in the step S31 or S32, the memory areas of the backup RAM 14 are initialized (step S35), whereupon the backup-power-supply-off decision circuit 17 is set to the backup state (i.e., initialized).
In the initialize step S35, the predetermined value held in the backup RAM 14 is so altered as to coincide with the decision reference value stored in the writable non-volatile ROM 12.
Thus, by disconnecting the vehicle-onboard control system from the battery 41 by manual operation after updating of the control program, the control variables stored within the backup RAM 14 can equally be initialized.
Further, when the data stored in the backup RAM 14 indicates an abnormal value, the backup RAM 14 can be initialized.
However, when the battery 41 is disconnected every time the control program is altered so as to conform with the updated specifications, the contents of other RAMs used by other various onboard control devices 42 which utilize in common the backup power supply circuit 30 are also cleared. In that case, it becomes necessary to initialize the other backup RAMs (not shown) provided for the various vehicle-onboard control devices 42. Thus, overhead involved in the rewriting process increases remarkably, to a great disadvantage.
Besides, when manual operation for disconnecting the backup power supply circuit 30 after updating the control program is not effected inadvertently, then the initialization processing of the backup RAM 14 can not be executed unless abnormality is decided in the step S32 shown in FIG. 13, giving rise to a problem that proper control as desired can not be performed due to unsuitableness of the control variables, because the control variables for the preceding control program are then used by the altered control program.
Additionally, when the control apparatus 1 and the motor vehicle are disconnected and reconnected after rewriting of the writable non-volatile ROM 12, omission of disconnection of the backup power source will bring about a serious problem. Moreover, an increased number of process steps involved in the alteration of the control program due to disconnection and reconnection of the battery or the backup power supply circuit provides a cause for high expensiveness.
As will now be appreciated from the foregoing, in the conventional vehicle-onboard control system for the motor vehicle, the backup power supply circuit 30 is disconnected through manual operation upon rewriting of the control program stored in the writable non-volatile ROM 12. Consequently, when disconnection of the backup power supply circuit 30 is omitted for some reason, initialization of the backup RAM 14 can not be effected unless abnormality of the backup data is decided, which gives birth to a problem that inconvenience will be incurred in controlling the onboard devices such as the internal combustion engine and others because of unfitness of the control variables held in the backup RAM 14.